bplist00�_WebMainResource_WebSubresources� _WebResourceData_WebResourceMIMEType_WebResourceTextEncodingName^WebResourceURL_WebResourceFrameNameOZMFJoe Sandbox Cloud Pro - Analysis Report 34027

Analysis Report

Overview

General Information

Joe Sandbox Version:	18.0.0
Analysis ID:	34027
Start time:	14:11:06
Joe Sandbox Product:	Cloud
Start date:	27.02.2017
Overall analysis duration:	0h 14m 10s
Report type:	full
Sample file name:	d19b903adbd0f8c119d0d8f25b194bdd24b737357a517f23ca5cdc6c75b35038.app
Cookbook file name:	default.jbs
Analysis system description:	Mac Mini, El Capitan 10.11.6 (Java 1.8.0_25)
Detection:	MAL
Classification:	mal60.rans.troj.macAPP@0/38@0/0
Warnings:	Show All Report creation exceeded maximum number of non-whitelisted processes and may have missing process information.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	60	0 - 100	Report FP / FN

Classification

Signature Overview

• Spam, unwanted Advertisements and Ransom Demands
• Networking
• Persistence and Installation Behavior
• System Summary
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Spam, unwanted Advertisements and Ransom Demands:

Deletes many files in the user directory

Show sources

Source: /usr/bin/zip (PID: 645)	User file deleted: /Users//Shared/.localized.crypt
Source: /usr/bin/zip (PID: 647)	User file deleted: /Users//Shared/adi.crypt
Source: /usr/bin/zip (PID: 651)	User file deleted: /Users//Shared/adi/adi-000001F5.pb.crypt
Source: /bin/rm (PID: 652)	User file deleted: /Users//Shared/adi/adi-000001F5.pb
Source: /usr/bin/zip (PID: 654)	User file deleted: /Users//Shared/adi/adi-000001F5.pb.lck.crypt
Source: /bin/rm (PID: 655)	User file deleted: /Users//Shared/adi/adi-000001F5.pb.lck
Source: /usr/bin/zip (PID: 657)	User file deleted: /Users//Shared/adi/adi.pb.crypt
Source: /bin/rm (PID: 658)	User file deleted: /Users//Shared/adi/adi.pb
Source: /usr/bin/zip (PID: 660)	User file deleted: /Users//Shared/adi/adi.pb.lck.crypt
Source: /bin/rm (PID: 661)	User file deleted: /Users//Shared/adi/adi.pb.lck
Source: /usr/bin/zip (PID: 663)	User file deleted: /Users//Shared/SC Info.crypt

Writes a notice file (html or txt) to demand a ransom

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Notice file created: /Users/vreni/Documents/README!.txt -> not your language? use https://translate.google.comwhat happened to your files ?all of your files were protected by a strong encryption method.what do i do ?so , there are two ways you can choose: wait for a miracle or start obtaining bitcoin now! , and restore your data the easy wayif you have really valuable data, you better not waste your time, because there is no other way to get your files, except make a paymentfollow these steps:1) learn how to buy bitcoin https://en.bitcoin.it/wiki/buying_bitcoins_(the_newbie_version)2)send 0.25 btc to 1ezrvz1kl7sqfemkh3p1vmtomyzbfhznkb3)send your btc address and your ip (you can get your ip here https://www.whatismyip.com) via mail to rihofoj@mailinator.com4)leave your computer on and connected to the internet for the next 24 hours after payment, your files will be unlocked. (if you can not wait 24 hours make a payment of 0.45 btc your files will be unlocked in max 10 minutes)keep in mind that your decryption key wi
Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Notice file created: /Users/vreni/Downloads/README!.txt -> not your language? use https://translate.google.comwhat happened to your files ?all of your files were protected by a strong encryption method.what do i do ?so , there are two ways you can choose: wait for a miracle or start obtaining bitcoin now! , and restore your data the easy wayif you have really valuable data, you better not waste your time, because there is no other way to get your files, except make a paymentfollow these steps:1) learn how to buy bitcoin https://en.bitcoin.it/wiki/buying_bitcoins_(the_newbie_version)2)send 0.25 btc to 1ezrvz1kl7sqfemkh3p1vmtomyzbfhznkb3)send your btc address and your ip (you can get your ip here https://www.whatismyip.com) via mail to rihofoj@mailinator.com4)leave your computer on and connected to the internet for the next 24 hours after payment, your files will be unlocked. (if you can not wait 24 hours make a payment of 0.45 btc your files will be unlocked in max 10 minutes)keep in mind that your decryption key wi
Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Notice file created: /Users/vreni/Movies/README!.txt -> not your language? use https://translate.google.comwhat happened to your files ?all of your files were protected by a strong encryption method.what do i do ?so , there are two ways you can choose: wait for a miracle or start obtaining bitcoin now! , and restore your data the easy wayif you have really valuable data, you better not waste your time, because there is no other way to get your files, except make a paymentfollow these steps:1) learn how to buy bitcoin https://en.bitcoin.it/wiki/buying_bitcoins_(the_newbie_version)2)send 0.25 btc to 1ezrvz1kl7sqfemkh3p1vmtomyzbfhznkb3)send your btc address and your ip (you can get your ip here https://www.whatismyip.com) via mail to rihofoj@mailinator.com4)leave your computer on and connected to the internet for the next 24 hours after payment, your files will be unlocked. (if you can not wait 24 hours make a payment of 0.45 btc your files will be unlocked in max 10 minutes)keep in mind that your decryption key will
Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Notice file created: /Users/vreni/Pictures/README!.txt -> not your language? use https://translate.google.comwhat happened to your files ?all of your files were protected by a strong encryption method.what do i do ?so , there are two ways you can choose: wait for a miracle or start obtaining bitcoin now! , and restore your data the easy wayif you have really valuable data, you better not waste your time, because there is no other way to get your files, except make a paymentfollow these steps:1) learn how to buy bitcoin https://en.bitcoin.it/wiki/buying_bitcoins_(the_newbie_version)2)send 0.25 btc to 1ezrvz1kl7sqfemkh3p1vmtomyzbfhznkb3)send your btc address and your ip (you can get your ip here https://www.whatismyip.com) via mail to rihofoj@mailinator.com4)leave your computer on and connected to the internet for the next 24 hours after payment, your files will be unlocked. (if you can not wait 24 hours make a payment of 0.45 btc your files will be unlocked in max 10 minutes)keep in mind that your decryption key wil
Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Notice file created: /Users/vreni/Music/README!.txt -> not your language? use https://translate.google.comwhat happened to your files ?all of your files were protected by a strong encryption method.what do i do ?so , there are two ways you can choose: wait for a miracle or start obtaining bitcoin now! , and restore your data the easy wayif you have really valuable data, you better not waste your time, because there is no other way to get your files, except make a paymentfollow these steps:1) learn how to buy bitcoin https://en.bitcoin.it/wiki/buying_bitcoins_(the_newbie_version)2)send 0.25 btc to 1ezrvz1kl7sqfemkh3p1vmtomyzbfhznkb3)send your btc address and your ip (you can get your ip here https://www.whatismyip.com) via mail to rihofoj@mailinator.com4)leave your computer on and connected to the internet for the next 24 hours after payment, your files will be unlocked. (if you can not wait 24 hours make a payment of 0.45 btc your files will be unlocked in max 10 minutes)keep in mind that your decryption key will n
Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Notice file created: /Users/vreni/Public/README!.txt -> not your language? use https://translate.google.comwhat happened to your files ?all of your files were protected by a strong encryption method.what do i do ?so , there are two ways you can choose: wait for a miracle or start obtaining bitcoin now! , and restore your data the easy wayif you have really valuable data, you better not waste your time, because there is no other way to get your files, except make a paymentfollow these steps:1) learn how to buy bitcoin https://en.bitcoin.it/wiki/buying_bitcoins_(the_newbie_version)2)send 0.25 btc to 1ezrvz1kl7sqfemkh3p1vmtomyzbfhznkb3)send your btc address and your ip (you can get your ip here https://www.whatismyip.com) via mail to rihofoj@mailinator.com4)leave your computer on and connected to the internet for the next 24 hours after payment, your files will be unlocked. (if you can not wait 24 hours make a payment of 0.45 btc your files will be unlocked in max 10 minutes)keep in mind that your decryption key will
Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Notice file created: /Users/vreni/README!.txt -> not your language? use https://translate.google.comwhat happened to your files ?all of your files were protected by a strong encryption method.what do i do ?so , there are two ways you can choose: wait for a miracle or start obtaining bitcoin now! , and restore your data the easy wayif you have really valuable data, you better not waste your time, because there is no other way to get your files, except make a paymentfollow these steps:1) learn how to buy bitcoin https://en.bitcoin.it/wiki/buying_bitcoins_(the_newbie_version)2)send 0.25 btc to 1ezrvz1kl7sqfemkh3p1vmtomyzbfhznkb3)send your btc address and your ip (you can get your ip here https://www.whatismyip.com) via mail to rihofoj@mailinator.com4)leave your computer on and connected to the internet for the next 24 hours after payment, your files will be unlocked. (if you can not wait 24 hours make a payment of 0.45 btc your files will be unlocked in max 10 minutes)keep in mind that your decryption key will not be

Writes encrypted ZIP files to disk

Show sources

Source: /usr/bin/find (PID: 641)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users/.crypt /Users/
Source: /usr/bin/find (PID: 642)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//.localized.crypt /Users//.localized
Source: /usr/bin/find (PID: 643)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//root.crypt /Users//root
Source: /usr/bin/find (PID: 644)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//Shared.crypt /Users//Shared
Source: /usr/bin/find (PID: 645)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//Shared/.localized.crypt /Users//Shared/.localized
Source: /usr/bin/find (PID: 647)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//Shared/adi.crypt /Users//Shared/adi
Source: /usr/bin/find (PID: 651)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//Shared/adi/adi-000001F5.pb.crypt /Users//Shared/adi/adi-000001F5.pb
Source: /usr/bin/find (PID: 654)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//Shared/adi/adi-000001F5.pb.lck.crypt /Users//Shared/adi/adi-000001F5.pb.lck
Source: /usr/bin/find (PID: 657)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//Shared/adi/adi.pb.crypt /Users//Shared/adi/adi.pb
Source: /usr/bin/find (PID: 660)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//Shared/adi/adi.pb.lck.crypt /Users//Shared/adi/adi.pb.lck
Source: /usr/bin/find (PID: 663)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//Shared/SC Info.crypt /Users//Shared/SC Info
Source: /usr/bin/find (PID: 665)	Touch executable: /usr/local/bin/zip -> zip -0 -P ZLwTBLsKGSg2Opc8mPrUNimCw /Users//vreni.crypt /Users//vreni

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic	TCP traffic: 192.168.0.50:49280 -> 17.252.92.24:5223
Source: global traffic	TCP traffic: 192.168.0.50:49279 -> 17.188.165.208:5223

Persistence and Installation Behavior:

Reads data from the local random generator

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Random device file read: /dev/random
Source: /usr/bin/zip (PID: 645)	Random device file read: /dev/random
Source: /usr/bin/zip (PID: 647)	Random device file read: /dev/random
Source: /usr/bin/zip (PID: 651)	Random device file read: /dev/random
Source: /usr/bin/zip (PID: 654)	Random device file read: /dev/random
Source: /usr/bin/zip (PID: 657)	Random device file read: /dev/random
Source: /usr/bin/zip (PID: 660)	Random device file read: /dev/random
Source: /usr/bin/zip (PID: 663)	Random device file read: /dev/random

Uses AppleKeyboardLayouts bundle containing keyboard layouts

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Creates hidden files, links and/or directories

Show sources

Source: /usr/bin/zip (PID: 645)	Hidden file created: /Users//Shared/.localized.crypt
Source: /usr/bin/zip (PID: 645)	Hidden file moved: /Users//Shared/zi7QDh7F -> /Users//Shared/.localized.crypt

Executes the "touch" command used to create files or modify time stamps

Show sources

Source: /usr/bin/find (PID: 626)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users/vreni/Documents/README!.txt
Source: /usr/bin/find (PID: 628)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users/vreni/Downloads/README!.txt
Source: /usr/bin/find (PID: 630)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users/vreni/Movies/README!.txt
Source: /usr/bin/find (PID: 632)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users/vreni/Pictures/README!.txt
Source: /usr/bin/find (PID: 634)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users/vreni/Music/README!.txt
Source: /usr/bin/find (PID: 636)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users/vreni/Public/README!.txt
Source: /usr/bin/find (PID: 638)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users/vreni/README!.txt
Source: /usr/bin/find (PID: 653)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users//Shared/adi/adi-000001F5.pb.crypt
Source: /usr/bin/find (PID: 656)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users//Shared/adi/adi-000001F5.pb.lck.crypt
Source: /usr/bin/find (PID: 659)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users//Shared/adi/adi.pb.crypt
Source: /usr/bin/find (PID: 662)	Touch executable: /usr/local/bin/touch -> touch -mt 201002130000 /Users//Shared/adi/adi.pb.lck.crypt

Reads launchservices plist files

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Reads user launchservices plist file containing default apps for corresponding filetypes

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)

Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Uses AppleScript framework/components containing Apple Script related functionalities

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)

AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist

Writes ZIP files to disk

Show sources

Source: /usr/bin/zip (PID: 645)	ZIP file created: /Users/Shared/zi7QDh7F
Source: /usr/bin/zip (PID: 647)	ZIP file created: /Users/Shared/ziVE84OT
Source: /usr/bin/zip (PID: 651)	ZIP file created: /Users/Shared/adi/zibSi5ej
Source: /usr/bin/zip (PID: 654)	ZIP file created: /Users/Shared/adi/zitlrfNu
Source: /usr/bin/zip (PID: 657)	ZIP file created: /Users/Shared/adi/zii615bE
Source: /usr/bin/zip (PID: 660)	ZIP file created: /Users/Shared/adi/zicf7gy6
Source: /usr/bin/zip (PID: 663)	ZIP file created: /Users/Shared/ziBbYxNR

Writes files to the user's download directory

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)

File created in download directory: /Users/vreni/Downloads/README!.txt

Executes the "rm" command used to delete files or directories

Show sources

Source: /usr/bin/find (PID: 646)	Rm executable: /usr/local/bin/rm -> rm /Users//Shared/.localized
Source: /usr/bin/find (PID: 649)	Rm executable: /Library/Frameworks/Python.framework/Versions/2.7/bin/rm -> rm /Users//Shared/adi
Source: /usr/bin/find (PID: 652)	Rm executable: /usr/local/bin/rm -> rm /Users//Shared/adi/adi-000001F5.pb
Source: /usr/bin/find (PID: 655)	Rm executable: /usr/local/bin/rm -> rm /Users//Shared/adi/adi-000001F5.pb.lck
Source: /usr/bin/find (PID: 658)	Rm executable: /usr/local/bin/rm -> rm /Users//Shared/adi/adi.pb
Source: /usr/bin/find (PID: 661)	Rm executable: /usr/local/bin/rm -> rm /Users//Shared/adi/adi.pb.lck
Source: /usr/bin/find (PID: 664)	Rm executable: /usr/local/bin/rm -> rm /Users//Shared/SC Info

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal60.rans.troj.macAPP@0/38@0/0

HIPS / PFW / Operating System Protection Evasion:

Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)

Sysctl read request: kern.safeboot (1.66)

Language, Device and Operating System Detection:

Reads the system or server version plist file

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)

System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Reads hardware related sysctl values

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)

Sysctl read request: hw.availcpu (6.25)

Reads the systems OS release and/or type

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Sysctl requested: kern.ostype (1.1)
Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)	Sysctl requested: kern.osrelease (1.2)

Reads the systems hostname

Show sources

Source: /Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher (PID: 621)

Sysctl requested: kern.hostname (1.10)

Runtime Messages

Command:	open
Exitcode:	0
Killed:	False
Standard Output:
Standard Error:

Yara Overview

No Yara matches

Screenshot

Startup

system is mac1

xpcproxy (PID: 621 PPID: 1 MD5: d68b4c6f2056c73e1d3bd228bcd6d4ff)

Office 2016 Patcher (PID: 621 PPID: 1 Overlayed Process Image: xpcproxy MD5: fc22fbe8dda4258a9f0ceb7e15a04fc2)

find (PID: 625 PPID: 621 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

find (PID: 626 PPID: 625 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 626 PPID: 625 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 627 PPID: 621 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

find (PID: 628 PPID: 627 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 628 PPID: 627 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 629 PPID: 621 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

find (PID: 630 PPID: 629 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 630 PPID: 629 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 631 PPID: 621 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

find (PID: 632 PPID: 631 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 632 PPID: 631 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 633 PPID: 621 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

find (PID: 634 PPID: 633 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 634 PPID: 633 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 635 PPID: 621 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

find (PID: 636 PPID: 635 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 636 PPID: 635 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 637 PPID: 621 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

find (PID: 638 PPID: 637 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 638 PPID: 637 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 640 PPID: 621 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

find (PID: 641 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 641 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 642 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 642 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 643 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 643 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 644 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 644 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 645 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 645 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 646 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

rm (PID: 646 PPID: 640 Overlayed Process Image: find MD5: e8926d2347850b76f57a1d5f0226de8b)

find (PID: 647 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 647 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 649 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

rm (PID: 649 PPID: 640 Overlayed Process Image: find MD5: e8926d2347850b76f57a1d5f0226de8b)

find (PID: 651 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 651 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 652 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

rm (PID: 652 PPID: 640 Overlayed Process Image: find MD5: e8926d2347850b76f57a1d5f0226de8b)

find (PID: 653 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 653 PPID: 640 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 654 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 654 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 655 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

rm (PID: 655 PPID: 640 Overlayed Process Image: find MD5: e8926d2347850b76f57a1d5f0226de8b)

find (PID: 656 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 656 PPID: 640 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 657 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 657 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 658 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

rm (PID: 658 PPID: 640 Overlayed Process Image: find MD5: e8926d2347850b76f57a1d5f0226de8b)

find (PID: 659 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 659 PPID: 640 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 660 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 660 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 661 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

rm (PID: 661 PPID: 640 Overlayed Process Image: find MD5: e8926d2347850b76f57a1d5f0226de8b)

find (PID: 662 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

touch (PID: 662 PPID: 640 Overlayed Process Image: find MD5: 6e95af6ebd7fd2dd9a0e26654024db31)

find (PID: 663 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 663 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

find (PID: 664 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

rm (PID: 664 PPID: 640 Overlayed Process Image: find MD5: e8926d2347850b76f57a1d5f0226de8b)

find (PID: 665 PPID: 640 MD5: 64fb7128066436f7954ecd6eaf22b2ad)

zip (PID: 665 PPID: 640 Overlayed Process Image: find MD5: 135ed1f0d2d93d1581715999e16cdeed)

cleanup

Created / dropped Files

File Path	Type and Hashes
/Users/Shared/adi/zibSi5ej	Type: Zip archive data, at least v1.0 to extract MD5: BFAE2B4486470611664F71E4E6A2251A SHA: 380C4952E74263B89B33A76EF2771F42FE95F139 SHA-256: A85A3C4EB8DC09CA552F03F4918CB8538CD92A736ECD2A72F27112DCF9324E40 SHA-512: 826FE09642170827EABE1CB459DEBAD109F5B4C89EA865AC06997BBD4E92E0C8842553696EC8F059592817AE5A92A8192B6C902A4655EB8B7138895A9C162F91
/Users/Shared/adi/zicf7gy6	Type: Zip archive data, at least v1.0 to extract MD5: 057BFDF43B9017885923F2EAEF4707D8 SHA: AD55078C026D2B0FD8E61B15CEDF67CA3CB989C4 SHA-256: 5759977C0B8865567B656A15774E17C81417B48A14A16684AAA3135442F94676 SHA-512: 82589F38B18D4807A0083BBAFB9CFB14C7EA36D5B282525CF24B0E62616F2F92B9734CC62DB7C8DC93624E354E472A03B186077A9993B76E62E05EC61CA59C65
/Users/Shared/adi/zii615bE	Type: Zip archive data, at least v1.0 to extract MD5: FEEC38381CC0653EA044C61AA29F3423 SHA: 1EEC6BF8A7E4AD47D64433EC1616FEE4224EDFC9 SHA-256: D5E5191EC3B8906C97D37958E7DFE4C303122CC4FA75D6EC40668D0010A4CA00 SHA-512: E30935F81C55DC2F85628957A1319C425C124DFE774B46E3E136D6E7A3B84F82B0A5D764F615013F7CA4987953775DF5F7AA41A2A0788219EA729A172ADB77B8
/Users/Shared/adi/zitlrfNu	Type: Zip archive data, at least v1.0 to extract MD5: 143FFAD4B46839DC8165A89B36A442B6 SHA: 4B86A54EC0AEA20A587C29D792F300C6320710AA SHA-256: 932FB3353CE2A1A83B47B3FF7BF7AFA4C8AC479DAAD11EF39BE09423AF3CF80D SHA-512: 37363FCC697F936ECE720647ADA76FDC500C03ABF0A0A78079FF51659B512045759D348B9532228A264EE15B428673D9527BD6C42AC5DF1CA593E3F585ED93F0
/Users/Shared/zi7QDh7F	Type: Zip archive data, at least v1.0 to extract MD5: 8DDFB702C22166B32E7C1B06AB83724B SHA: C0C362B4235EF72E6D2340221C1B9C52DFFA6BF2 SHA-256: 989D25825CF685C8BF6EFE58E71525029D793BFD7B9194D5EBBF03A1C15D9E88 SHA-512: F6587B406542E5FDF77177E38C0FBE4C51F61A9FF068B6D8CE7313AD559C9026015FE97F904F04D5FE2A90BBB3C907445B88AFD2B4CD711AFE3DD392071B7141
/Users/Shared/ziBbYxNR	Type: Zip archive data, at least v1.0 to extract MD5: D2B931247FB93F1240F8E3C062F45C99 SHA: 2E57EDE910340059EDF2B18275EF53C11F767851 SHA-256: 5A274804A8022632A86492B6330AE8ACF2D889C6E078AA47F85FB22039DC6887 SHA-512: 4F967FFF4ADC723513509FEF1DCE9B6CA77E04B8F587AA2DFE1E31BB137522FCC429CDB6F4DED6C0292015D98C5D9153DA025C00CCADFBE46A3A11C52DC23F2E
/Users/Shared/ziVE84OT	Type: Zip archive data, at least v1.0 to extract MD5: 4C9F8AEE6AD8758E4FFAB292D59572D7 SHA: 05778C79F73EBB6D7D9FD837B464D4ADD7CF32F6 SHA-256: FD29703FCFAAE7BCE0C45F5EB24A84C3E32AEAC842822EA50C24165936A9EC0C SHA-512: 9BA7B58D62E886DF86473478EC34CDD4DD4F25DC3B2D98DB7BF5A0B27D308FFD8FE0C26EE939CE98905D39154C536344B25865176D52483F71758A1AEF64AB0F
/Users/vreni/Documents/README!.txt	Type: ASCII English text, with CRLF line terminators MD5: C7432C5AA5ECD16C5E176A54B8A4A2FA SHA: 32757607B758AB0F5E86412DF048182C2EE6F377 SHA-256: CCC5010A9B4504BBAD63C6787750E6461614AA3A17FB379590780F335B7D99C8 SHA-512: B12FB9DD40DE08D16F3D493514D7014464F21CD86A8221FAD47C983A073A656A65CF03994D6635776DB741724D5D3EE0008DCB821228489DA638F77CC137C551
/Users/vreni/Downloads/README!.txt	Type: ASCII English text, with CRLF line terminators MD5: C7432C5AA5ECD16C5E176A54B8A4A2FA SHA: 32757607B758AB0F5E86412DF048182C2EE6F377 SHA-256: CCC5010A9B4504BBAD63C6787750E6461614AA3A17FB379590780F335B7D99C8 SHA-512: B12FB9DD40DE08D16F3D493514D7014464F21CD86A8221FAD47C983A073A656A65CF03994D6635776DB741724D5D3EE0008DCB821228489DA638F77CC137C551
/Users/vreni/Movies/README!.txt	Type: ASCII English text, with CRLF line terminators MD5: C7432C5AA5ECD16C5E176A54B8A4A2FA SHA: 32757607B758AB0F5E86412DF048182C2EE6F377 SHA-256: CCC5010A9B4504BBAD63C6787750E6461614AA3A17FB379590780F335B7D99C8 SHA-512: B12FB9DD40DE08D16F3D493514D7014464F21CD86A8221FAD47C983A073A656A65CF03994D6635776DB741724D5D3EE0008DCB821228489DA638F77CC137C551
/Users/vreni/Music/README!.txt	Type: ASCII English text, with CRLF line terminators MD5: C7432C5AA5ECD16C5E176A54B8A4A2FA SHA: 32757607B758AB0F5E86412DF048182C2EE6F377 SHA-256: CCC5010A9B4504BBAD63C6787750E6461614AA3A17FB379590780F335B7D99C8 SHA-512: B12FB9DD40DE08D16F3D493514D7014464F21CD86A8221FAD47C983A073A656A65CF03994D6635776DB741724D5D3EE0008DCB821228489DA638F77CC137C551
/Users/vreni/Pictures/README!.txt	Type: ASCII English text, with CRLF line terminators MD5: C7432C5AA5ECD16C5E176A54B8A4A2FA SHA: 32757607B758AB0F5E86412DF048182C2EE6F377 SHA-256: CCC5010A9B4504BBAD63C6787750E6461614AA3A17FB379590780F335B7D99C8 SHA-512: B12FB9DD40DE08D16F3D493514D7014464F21CD86A8221FAD47C983A073A656A65CF03994D6635776DB741724D5D3EE0008DCB821228489DA638F77CC137C551
/Users/vreni/Public/README!.txt	Type: ASCII English text, with CRLF line terminators MD5: C7432C5AA5ECD16C5E176A54B8A4A2FA SHA: 32757607B758AB0F5E86412DF048182C2EE6F377 SHA-256: CCC5010A9B4504BBAD63C6787750E6461614AA3A17FB379590780F335B7D99C8 SHA-512: B12FB9DD40DE08D16F3D493514D7014464F21CD86A8221FAD47C983A073A656A65CF03994D6635776DB741724D5D3EE0008DCB821228489DA638F77CC137C551
/Users/vreni/README!.txt	Type: ASCII English text, with CRLF line terminators MD5: C7432C5AA5ECD16C5E176A54B8A4A2FA SHA: 32757607B758AB0F5E86412DF048182C2EE6F377 SHA-256: CCC5010A9B4504BBAD63C6787750E6461614AA3A17FB379590780F335B7D99C8 SHA-512: B12FB9DD40DE08D16F3D493514D7014464F21CD86A8221FAD47C983A073A656A65CF03994D6635776DB741724D5D3EE0008DCB821228489DA638F77CC137C551
/dev/null	Type: ASCII text MD5: 7EC1DBAE159976428D6A57677A28DB1B SHA: D0BCF52EA275C6F917615C40E91582325AE87E85 SHA-256: E1FD3A701C0248EAA0C0FA00503D2DE8DE410AF1171A939D4FE932193E6F52C3 SHA-512: EDBDEF028D351827B6A38D5B6D8441D7FB312AAA4752C8EF3508FFCE02AB36873972957B18201A3FCBAA7A0AD2D10AF64A69378B31A29E5526B7C796FD0F9647

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name
17.188.165.208	United States	714	AppleInc
8.8.4.4	United States	15169	GoogleInc
17.252.92.24	United States	714	AppleInc

Static File Info

General
File type:	Zip archive data, at least v1.0 to extract
TrID:	ZIP compressed archive (4004/1) 99.83% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.17%
File name:	d19b903adbd0f8c119d0d8f25b194bdd24b737357a517f23ca5cdc6c75b35038.app
File size:	2286979
MD5:	1b8be665af7729618d70bad773aac423
SHA1:	1b7380d283ceebcabb683464ba0bb6dd73d6e886
SHA256:	d19b903adbd0f8c119d0d8f25b194bdd24b737357a517f23ca5cdc6c75b35038
SHA512:	f7ef377ae59a6316678775ef221070199409ff8b9bf04b311cee98edcd62576dec9946dba2cdfc959ed09fb2920bfe4d018036719e934778531f8285aee26f91
File Content Preview:	PK.........n.J................Office 2016 Patcher.app/UX..!.zX..zX....PK.........n.J............!...Office 2016 Patcher.app/Contents/UX..!.zX..zX....PK.........n.J............0...Office 2016 Patcher.app/Contents/_CodeSignature/UX.. .zX..zX....PK.........n

Static App Info

General Informations

Package Info:

APPL????

Property List File:

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>BuildMachineOSBuild</key><string>15G31</string><key>CFBundleDevelopmentRegion</key><string>en</string><key>CFBundleExecutable</key><string>Office 2016 Patcher</string><key>CFBundleIconFile</key><string>AppIcon</string><key>CFBundleIdentifier</key><string>NULL.prova</string><key>CFBundleInfoDictionaryVersion</key><string>6.0</string><key>CFBundleName</key><string>Office 2016 Patcher</string><key>CFBundlePackageType</key><string>APPL</string><key>CFBundleShortVersionString</key><string>1.0</string><key>CFBundleSupportedPlatforms</key><array><string>MacOSX</string></array><key>CFBundleVersion</key><string>1</string><key>DTCompiler</key><string>com.apple.compilers.llvm.clang.1_0</string><key>DTPlatformBuild</key><string>8C38</string><key>DTPlatformVersion</key><string>GM</string><key>DTSDKBuild</key><string>16C58</string><key>DTSDKName</key><string>macosx10.12</string><key>DTXcode</key><string>0820</string><key>DTXcodeBuild</key><string>8C38</string><key>LSMinimumSystemVersion</key><string>10.11</string><key>NSHumanReadableCopyright</key><string>Copyright 2017 NULL. All rights reserved.</string><key>NSMainNibFile</key><string>MainMenu</string><key>NSPrincipalClass</key><string>NSApplication</string></dict></plist>

Frameworks

Name	Type
libswiftAppKit.dylib	Mach-O 64-bit dynamically linked shared library
libswiftCore.dylib	Mach-O 64-bit dynamically linked shared library
libswiftCoreData.dylib	Mach-O 64-bit dynamically linked shared library
libswiftCoreGraphics.dylib	Mach-O 64-bit dynamically linked shared library
libswiftCoreImage.dylib	Mach-O 64-bit dynamically linked shared library
libswiftDarwin.dylib	Mach-O 64-bit dynamically linked shared library
libswiftDispatch.dylib	Mach-O 64-bit dynamically linked shared library
libswiftFoundation.dylib	Mach-O 64-bit dynamically linked shared library
libswiftIOKit.dylib	Mach-O 64-bit dynamically linked shared library
libswiftObjectiveC.dylib	Mach-O 64-bit dynamically linked shared library
libswiftQuartzCore.dylib	Mach-O 64-bit dynamically linked shared library
libswiftXPC.dylib	Mach-O 64-bit dynamically linked shared library

Resources

Name	Type
AppIcon.icns	data
Office 2016 Patcher	Mach-O 64-bit executable

Static Mach Info

General Informations for header0
Endian:	<
Size:	64-bit
Architecture:	x86_64
Filetype:	execute
Nbr. of load commands:	33

segment_command_64

Name	Value
segname	__PAGEZERO
fileoff	0
maxprot	0
vmsize	4294967296
nsects	0
flags	0
filesize	0
vmaddr	0
initprot	0

segment_command_64

Name	Value
segname	__TEXT
fileoff	0
maxprot	7
vmsize	28672
nsects	12
flags	0
filesize	28672
vmaddr	4294967296
initprot	5
Datas	sectname	__text
	segname	__TEXT
	reloff	0
	addr	4294972688
	align	4
	nreloc	0
	flags	2147484672
	offset	5392
	reserved2	0
	reserved1	0
	reserved3	0
	size	15572
	sectname	__stubs
	segname	__TEXT
	reloff	0
	addr	4294988260
	align	1
	nreloc	0
	flags	2147484680
	offset	20964
	reserved2	6
	reserved1	0
	reserved3	0
	size	204
	sectname	__stub_helper
	segname	__TEXT
	reloff	0
	addr	4294988464
	align	2
	nreloc	0
	flags	2147484672
	offset	21168
	reserved2	0
	reserved1	0
	reserved3	0
	size	356
	sectname	__const
	segname	__TEXT
	reloff	0
	addr	4294988832
	align	4
	nreloc	0
	flags	0
	offset	21536
	reserved2	0
	reserved1	0
	reserved3	0
	size	354
	sectname	__cstring
	segname	__TEXT
	reloff	0
	addr	4294989200
	align	4
	nreloc	0
	flags	2
	offset	21904
	reserved2	0
	reserved1	0
	reserved3	0
	size	4058
	sectname	__objc_methname
	segname	__TEXT
	reloff	0
	addr	4294993258
align	0
nreloc	0
flags	2
offset	25962
reserved2	0
reserved1	0
reserved3	0
size	1888
sectname	__swift3_typeref
segname	__TEXT
reloff	0
addr	4294995152
align	4
nreloc	0
flags	0
offset	27856
reserved2	0
reserved1	0
reserved3	0
size	257
sectname	__swift3_reflstr
segname	__TEXT
reloff	0
addr	4294995409
align	0
nreloc	0
flags	0
offset	28113
reserved2	0
reserved1	0
reserved3	0
size	33
sectname	__swift3_fieldmd
segname	__TEXT
reloff	0
addr	4294995444
align	2
nreloc	0
flags	0
offset	28148
reserved2	0
reserved1	0
reserved3	0
size	108
sectname	__swift3_assocty
segname	__TEXT
reloff	0
addr	4294995552
align	2
nreloc	0
flags	0
offset	28256
reserved2	0
reserved1	0
reserved3	0
size	96
sectname	__unwind_info
segname	__TEXT
reloff	0
addr	4294995648
align	2
nreloc	0
flags	0
offset	28352
reserved2	0
reserved1	0
reserved3	0
size	164
sectname	__eh_frame
segname	__TEXT
reloff	0
addr	4294995816
align	3
nreloc	0
flags	0
offset	28520
reserved2	0
reserved1	0
reserved3	0
size	152

segment_command_64

Name	Value
segname	__DATA
fileoff	28672
maxprot	7
vmsize	8192
nsects	14
flags	0
filesize	8192
vmaddr	4294995968
initprot	3
Datas	sectname	__got
	segname	__DATA
	reloff	0
	addr	4294995968
	align	3
	nreloc	0
	flags	6
	offset	28672
	reserved2	0
	reserved1	34
	reserved3	0
	size	88
	sectname	__nl_symbol_ptr
	segname	__DATA
	reloff	0
	addr	4294996056
	align	3
	nreloc	0
	flags	6
	offset	28760
	reserved2	0
	reserved1	45
	reserved3	0
	size	16
	sectname	__la_symbol_ptr
	segname	__DATA
	reloff	0
	addr	4294996072
	align	3
	nreloc	0
	flags	7
	offset	28776
	reserved2	0
	reserved1	47
	reserved3	0
	size	272
	sectname	__objc_classlist
	segname	__DATA
	reloff	0
	addr	4294996344
	align	3
	nreloc	0
	flags	268435456
	offset	29048
	reserved2	0
	reserved1	0
	reserved3	0
	size	8
	sectname	__objc_protolist
	segname	__DATA
	reloff	0
	addr	4294996352
	align	3
	nreloc	0
	flags	0
	offset	29056
	reserved2	0
	reserved1	0
	reserved3	0
	size	24
	sectname	__objc_imageinfo
	segname	__DATA
	reloff	0
	addr	4294996376
align	2
nreloc	0
flags	0
offset	29080
reserved2	0
reserved1	0
reserved3	0
size	8
sectname	__objc_const
segname	__DATA
reloff	0
addr	4294996384
align	3
nreloc	0
flags	0
offset	29088
reserved2	0
reserved1	0
reserved3	0
size	3312
sectname	__objc_selrefs
segname	__DATA
reloff	0
addr	4294999696
align	3
nreloc	0
flags	268435461
offset	32400
reserved2	0
reserved1	0
reserved3	0
size	104
sectname	__objc_protorefs
segname	__DATA
reloff	0
addr	4294999800
align	3
nreloc	0
flags	0
offset	32504
reserved2	0
reserved1	0
reserved3	0
size	24
sectname	__objc_classrefs
segname	__DATA
reloff	0
addr	4294999824
align	3
nreloc	0
flags	268435456
offset	32528
reserved2	0
reserved1	0
reserved3	0
size	48
sectname	__objc_data
segname	__DATA
reloff	0
addr	4294999872
align	3
nreloc	0
flags	0
offset	32576
reserved2	0
reserved1	0
reserved3	0
size	272
sectname	__data
segname	__DATA
reloff	0
addr	4295000144
align	3
nreloc	0
flags	0
offset	32848
reserved2	0
reserved1	0
reserved3	0
size	232
sectname	__common
segname	__DATA
reloff	0
addr	4295000376
align	3
nreloc	0
flags	1
offset	0
reserved2	0
reserved1	0
reserved3	0
size	8
sectname	__bss
segname	__DATA
reloff	0
addr	4295000384
align	3
nreloc	0
flags	1
offset	0
reserved2	0
reserved1	0
reserved3	0
size	8

segment_command_64

Name	Value
segname	__LINKEDIT
fileoff	36864
maxprot	7
vmsize	20480
nsects	0
flags	0
filesize	16848
vmaddr	4295004160
initprot	1

dyld_info_command

Name	Value
lazy_bind_size	1576
lazy_bind_off	38264
weak_bind_size	0
rebase_size	200
export_off	39840
export_size	104
bind_off	37064
rebase_off	36864
bind_size	1200
weak_bind_off	0

symtab_command

Name	Value
strsize	2344
symoff	39984
stroff	41428
nsyms	70

dysymtab_command

Name	Value
extreloff	0
nlocrel	0
indirectsymoff	41104
modtaboff	0
nextrel	0
iundefsym	2
nmodtab	0
ilocalsym	0
nundefsym	68
nextrefsyms	0
locreloff	0
ntoc	0
nlocalsym	1
tocoff	0
extrefsymoff	0
nindirectsyms	81
iextdefsym	1
nextdefsym	1

dylinker_command

Name	Value
name	12
Data	/usr/lib/dyld

uuid_command

Name	Value
uuid	c648413d14dc3d79b3525d7b92cfded8

version_min_command

Name	Value
version	658176
reserved	658432

source_version_command

Name	Value
version	0

entry_point_command

Name	Value
stacksize	0
entryoff	6960

dylib_command

Name	Value
compatibility_version	0.44.1
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	6400.69.5
Data	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	0.228.0
Data	/usr/lib/libobjc.A.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	0.214.4
Data	/usr/lib/libSystem.B.dylib

dylib_command

Name	Value
compatibility_version	0.45.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	19200.224.5
Data	/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

dylib_command

Name	Value
compatibility_version	0.150.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	7168.68.5
Data	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftAppKit.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftCore.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftCoreData.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftCoreGraphics.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftCoreImage.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftDarwin.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftDispatch.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftFoundation.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftIOKit.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftObjectiveC.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftQuartzCore.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	63.32.3
Data	@rpath/libswiftXPC.dylib

rpath_command

Name	Value
path	12
Data	@executable_path/../Frameworks

linkedit_data_command

Name	Value
dataoff	39944
datassize	40

linkedit_data_command

Name	Value
dataoff	39984
datassize	0

linkedit_data_command

Name	Value
dataoff	43776
datassize	9936

Network Behavior

Download Network PCAP:	Network PCAP

Network Port Distribution

Total Packets: 6
• 5223 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2017 14:13:41.102061987 MEZ	53508	53	192.168.0.50	8.8.4.4
Feb 27, 2017 14:13:42.101917982 MEZ	53	53508	8.8.4.4	192.168.0.50
Feb 27, 2017 14:13:48.749927044 MEZ	49280	5223	192.168.0.50	17.252.92.24
Feb 27, 2017 14:13:48.749958992 MEZ	5223	49280	17.252.92.24	192.168.0.50
Feb 27, 2017 14:13:48.821258068 MEZ	5223	49280	17.252.92.24	192.168.0.50
Feb 27, 2017 14:13:48.821456909 MEZ	49280	5223	192.168.0.50	17.252.92.24
Feb 27, 2017 14:13:50.815836906 MEZ	49279	5223	192.168.0.50	17.188.165.208
Feb 27, 2017 14:13:50.815860987 MEZ	5223	49279	17.188.165.208	192.168.0.50
Feb 27, 2017 14:13:50.965436935 MEZ	5223	49279	17.188.165.208	192.168.0.50
Feb 27, 2017 14:13:50.965703964 MEZ	49279	5223	192.168.0.50	17.188.165.208

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2017 14:13:41.102061987 MEZ	53508	53	192.168.0.50	8.8.4.4
Feb 27, 2017 14:13:42.101917982 MEZ	53	53508	8.8.4.4	192.168.0.50

System Behavior

Analysis Process: xpcproxy PID: 621 Parent PID: 1

General

Start time:	14:11:36
Start date:	27/02/2017
Path:	/usr/libexec/xpcproxy
File size:	42656 bytes
MD5 hash:	d68b4c6f2056c73e1d3bd228bcd6d4ff

File Activities

File Opened

Directory Created

Process Activities

Process Spawned

General

Start time:	14:11:36
Start date:	27/02/2017
Path:	/Users/vreni/Desktop/unpack/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher
File size:	53712 bytes
MD5 hash:	fc22fbe8dda4258a9f0ceb7e15a04fc2

Process Activities

Process Spawned

General

Start time:	14:11:39
Start date:	27/02/2017
Path:	/usr/bin/find
File size:	51584 bytes
MD5 hash:	64fb7128066436f7954ecd6eaf22b2ad

Start time:	14:11:40
Start date:	27/02/2017
Path:	/usr/bin/find
File size:	51584 bytes
MD5 hash:	64fb7128066436f7954ecd6eaf22b2ad

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Classification

Signature Overview

Spam, unwanted Advertisements and Ransom Demands:

Networking:

Persistence and Installation Behavior:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Runtime Messages

Yara Overview

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

Static App Info

General Informations

Frameworks

Resources

Static Mach Info

General Informations for header0

segment_command_64

segment_command_64

segment_command_64

segment_command_64

dyld_info_command

symtab_command

dysymtab_command

dylinker_command

uuid_command

version_min_command

source_version_command

entry_point_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

dylib_command

rpath_command

linkedit_data_command

linkedit_data_command

linkedit_data_command

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

System Behavior

Analysis Process: xpcproxy PID: 621 Parent PID: 1

General

File Activities

File Opened

Directory Created

Process Activities